Web Server error on 81.10.10 Spark Appliance ( 1500, 1600 ) SMP managed

[JeffCote]

Hi everyone.
Since the 81.10.10 firmware on Quantum Spark appliances ( managed through the Spark Management Platform) several of the firewall i manage get the same type of error.

It begins with error 00362, then after a while, it disconnect from the SMP cloud services and go into Outgoing policies only.

Those firewalls also generate system logs with this entry:

fwobj_get_converted_set_as_string: Conversion failed with error: /usr/local/share/lua/5.1/conversion/convert.lua:0: /usr/local/share/lua/5.1/conversion/convert.lua:0: conversion.convert.handle_match: services in /opt/fw1/conf/objects.conv

Anyone else encountered that ?

Thanks 

[Lesley]

Try disconnecting the device from SMP and reconnecting it.

[the_rock]

I would definitely open TAC case for that.

Andy

[JeffCote]

We opened 3 by now.
But it always ended up with TAC suggesting a factory reset of the appliance.

[JeffCote]

We were able to recreate the issue.

Create NAT rules locally on the firewall.
Create access rules for those NAT using the same object you created for the NAT rules.
Create some rules on the Spark Management Platform.
Link the firewall to the Spark Management Platform and wait.
At some point, the platform will push changes to the firewall and the script will create 3 instances of every objects used for the NAT in the database.
This is what create the "cannot write to the database" error, soon after that, the "web server errors" will begin.

[PhoneBoy]

If you can reproduce this, a TAC case will definitely help us resolve this.

[Dafna]

HI,

Please open a task.

Is it possible to get access to your gateway via reach my device?

Thanks 

  Dafna

[samadhi]

Hi,

I have the same issue with several 1570s using R81.10.10_996002945. We've seen the same issues with all R81.10.10 releases.

Any useful suggestions, other than resetting the appliance to factory defaults ?

PS: Disconnecting from cloud would sometime result in an inaccessible device.

Cheers,
Sam

[the_rock]

Do you have TAC case opened for the issue?

Andy

[samadhi]

Hi,

Will be able to open TAC case soonest tomorrow.
Had quite a few TAC cases along the way, after 81.10.10 release. Recommendation received here, repeatedly: resetting to factory defaults or downgrade. The latter was the best option for us, most of the time.

The very last encounter of the issue appeared one hour ago, on a otherwise working device until we created a new Network Object (DHCP reservation for a certain MAC address).

Since device is in production disconnecting from SMP is not an option. Deleting the newly created Network Object had no effect.

Was kinda hoping for a "magic" solution to rebuild the fw rules from CLI. Pushing reapply of current plan from SMP or fetching new rules in SMB UI had no effect.

Thanks,
Sam

[Amir_Ayalon]

Hi Sam

when opening an SR please ask TAC to open a Task for R&D.

we will look into it.

thanks

[samadhi]

Hi,

TAC tichet opened: 6-0004036075

Cheers,
Stefan

[the_rock]

I hope they provide you with something good. I know this can be frustrating situation, as we all always try to avoid rebuilding a fw.

Andy

[JeffCote]

Had to open yet ANOTHER ticket since yet ANOTHER of the firewall we manage just had the problem after creating a rule.

Service Request# : 6-0004042344

[vladdar]

This is something i have also encountered on R81.10.15. We encountered another bug with cluster of 1800, when the cluter WAN IP stopped responding and all associated VPN tunels (sourced from VIP) also stopped working. R&D was not able to help me as I was not able to replicate the issue on call with them. We tried testing on borrowed Spark 2000 with trial licences for testing purposes but the issue repeated. Then I have tried upgrading the cluster to R81.10.15 and I am seeing same issue as OP. Web server error and this line in /var/log/messages

2025 Feb 11 11:24:27 xxx user.err root: [System error] CODE_SYS_ERROR (8712.149.48) - sys/OSTLORM.lua:48: Failed to connect (Log reference: 1739269467)

P.S.: We are using local management and cluster is not connected to cloud Spark Management